At Babylon Health, we are on a mission to put accessible and affordable healthcare in the hands of every person on Earth. You might imagine that such an endeavour would generate incredible amounts of data! And, since AI is in the core of our product, leveraging data from our microservices and clients is crucial to our success. So we set off to build a data platform of the future, based both in AWS and GCP, leveraging our existing infrastructure and CICD and building the missing parts.

3. AirFlow and GCP:
tomorrow's health service data platform
Natalie Godec,
Platform Engineer,
Babylon Health

4. $ whoami
Natalie Godec
Babylon Health
DevOps (♥ω♥)
Infrastructure
ouvessvit

5. Part I
Our mission

6. Babylon’s mission is to put an
accessible and affordable
health service in the hands of
every person on Earth

7. Babylon Health Services
MonitorAsk Babylon Talk to a doctor Symptom Checker

8. Monitor

9. Global

10. Part II
Data in AI-driven healthcare

11. Data sources
Event stream App&Web Analytics
External datasets Logs

13. What are we trying to achieve?
data
collect
store
create insights
analyse
secure
research
make data driven decisions

14. Enable teams to access, analyse
and research on provided data,
in an accessible, secure and
auditable manner

15. Data Tech (the old ways…)

16. Data Tech (the old ways…)
Data Analyst 1
Data Analyst 2
Natalie Godec

17. Data Tech (the old ways…)
● Infrastructure management overhead
● Requires special skills
● Difficult to scale
● Lack of granular access control
● Speed is a real issue
● Expensive

18. Researcher
My dataset
Legal and DP
approval?
DBS Check?
Data Source
Secure Access Right tools?
Where is the
data?
Accessing data (the old ways…)

20. How can we give researchers access to
the data they need, when they need it,
safely and securely?

21. Monitor
Google
BigQuery

22. Built-in DR
Fast
Cost-effective
Scalable
REST API
Fully managed
BigQuery
Data warehousing service

23. BigQuery: a data warehouse
● Create datasets
● Define table schemas
● Create tables and views
● Schedule jobs
GCPproject
UK
US
CA
Datasets Tables & Views
SELECT date, count(VisitorId) FROM
`project1.datasetA.frontend.ga_sessions_*`
group by date

24. What will you do with data?
Google
BigQuery

25. Babylon’s end-to-end example
Transform & verify
Cloud Composer
Visualise
Tableau, Looker
Google BigQuery
Google Cloud
Storage
Direct query
BigQuery
ML pipelines
Kubeflow
AWS EKS
Kafka

26. Cloud Composer: your data pipelines scheduler
GKE
Cloud Composer
Environment
Apache Airflow
Google Cloud
Storage
Scheduler
Webserver
Database
DAGs

27. Cloud Composer: your data pipelines scheduler
Cloud Composer
Environment
Apache Airflow
BigQuery
Scheduler
Webserver
Database
DAGs
Version control
GithubGKEGoogle Cloud
Storage

28. DAGs: Directed Acyclic Graphs
Python
operator
Branching
Python
operator
SQL
operator
Custom
operator
end
├── dags
│ └── UK_scripts
│ ├── dataset1
│ └── dataset2
├── plugins
│ └── control_plugin
│ └── operators
└── schemas
├── dataset1
└── dataset2
Data_processing

29. Babylon’s end-to-end example
Transform & verify
Cloud Composer
Visualise
Tableau, Looker
Google BigQuery
Google Cloud
Storage
Direct query
BigQuery
ML pipelines
Kubeflow
AWS EKS
Kafka

30. Part III
Infrastructure

31. BigQuery
datasets
Cloud
Composer
Storage VPC
GCP Project

32. BigQuery
datasets
Cloud
Composer
Storage VPC
GCP Project
IAM
Service
Accounts
VPCService
Controls
VPN

33. Terraform!

34. Infrastructure components
├── vpc-service-perimeter
├── gcp-aws-vpn
├── gcp-network
├── big-query
├── cloud-composer
├── gcp-buckets
├── gcp-projects
├── gcp-service-account
└── google-groups-access
├── gcp
│ ├── vpc
│ ├── cloud-composer
│ ├── big-query-dataset
│ ├── big-query-table
│ ├── bucket
│ ├── project
│ ├── service-account-bq
└── aws
└── components └── modules

35. Demo

36. GCP Access Model
Read DS1
project1
roles/bigquery.user
ACL
ACL

37. GCP Project
roles/bigquery.user
roles/project.admin
roles/babylon_read
ACL
IAM
ACL
ACL
Google
BigQuery

38. Prod project
Data champions
Debug access
Prod data
Insights
BQ r/w
read
Global Analytics
read
Research Workspace
read
BQ r/w
BQ r/w

39. BigQuery is a public API.
How do you protect your data?

40. Office IP range
Private cloud IP range
Securing your APIs:
VPC Service Controls
Unauthorized
client
VPC Service Perimeter
Unauthorized
VPC project
project1
project2
project3
Protected APIs

41. vpc-service-perimeter/
└── terraform
├── access-levels.tf
├── perimeters.tf
├── bridges.tf
├── backend.tf
├── data.tf
├── environments
├── locals.tf
├── provider.tf
└── vars.tf
project1
project2
project3
BigQuery
IP1
IP2
VPC Service Perimeter
VPC Service Controls

42. VPC Service Controls
prod-uk
Main
prod-ca
prod-sg
frontend-data
Trusted Research
Perimeter
analytics
insights
Bridge
GCP
AWS
Data champions
Debug access
Insights
Analysts

43. AWS to GCP through a perimeter?
project1
project2
project3
VPN
GW
GCP
VPC Service Perimeter
AWS
account1
VPN
GW
Microservices
VPN tunnel

44. AWS to GCP through a perimeter?
Destination Target Status Prop
10.1.2.3/24 vgw-012345 active Yes
10.4.5.6/16 vgw-012345 active Yes
10.7.8.9/16 vgw-012345 active Yes
GCP: route table
AWS : route table
Destination range Next Hop Network
10.2.0.1/16 141.224.170.66 prod-uk
10.20.1.1/16 141.224.170.66 Prod-uk
AWS: VPN Gateway
ID: vgw-012345
GCP: VPN Gateway
BGP Peer IP:
141.224.170.66
*IP addresses are randomly generated

45. I need!
data analyst data engineer
1. Analyse need
2. Map Data
3. Write DAGs
4. Deploy!
Data Engineering Workflow

46. Fancy conclusion slide

47. Get in touch
linkedin.com/in/nataliia-godec/
instagram.com/ouvessvit/
twitter.com/Babylon_Eng
https://medium.com/babylon-engineering